alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

[acme db interface] wip

Browse source
This commit is contained in:
max furman 2021-02-27 17:05:37 -08:00
parent 0368957e79
commit 461bad3fef
19 changed files with 567 additions and 1251 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

0
acme/types/account.go → acme/account.go
View file

83
acme/authority.go
View file

@ -6,6 +6,7 @@ import (
"crypto/tls"
"crypto/x509"
"encoding/base64"
"log"
"net"
"net/http"
"net/url"
@ -69,17 +70,6 @@ type AuthorityOptions struct {
Prefix string
}
var (
accountTable = []byte("acme_accounts")
accountByKeyIDTable = []byte("acme_keyID_accountID_index")
authzTable = []byte("acme_authzs")
challengeTable = []byte("acme_challenges")
nonceTable = []byte("nonces")
orderTable = []byte("acme_orders")
ordersByAccountIDTable = []byte("acme_account_orders_index")
certTable = []byte("acme_certs")
)
// NewAuthority returns a new Authority that implements the ACME interface.
//
// Deprecated: NewAuthority exists for hitorical compatibility and should not
@ -197,14 +187,23 @@ func (a *Authority) GetAccountByKey(ctx context.Context, jwk *jose.JSONWebKey) (
// GetOrder returns an ACME order.
func (a *Authority) GetOrder(ctx context.Context, accID, orderID string) (*Order, error) {
o, err := getOrder(a.db, orderID)
prov, err := ProvisionerFromContext(ctx)
if err != nil {
return nil, err
}
o, err := a.db.GetOrder(ctx, orderID)
if err != nil {
return nil, ServerInternalErr(err)
}
if accID != o.AccountID {
log.Printf("account-id from request ('%s') does not match order account-id ('%s')", accID, o.AccountID)
return nil, UnauthorizedErr(errors.New("account does not own order"))
}
if o, err = o.updateStatus(a.db); err != nil {
if prov.GetID() != o.ProvisionerID {
log.Printf("provisioner-id from request ('%s') does not match order provisioner-id ('%s')", prov.GetID(), o.ProvisionerID)
return nil, UnauthorizedErr(errors.New("provisioner does not own order"))
}
if err = a.updateOrderStatus(ctx, o); err != nil {
return nil, err
}
return o.toACME(ctx, a.db, a.dir)
@ -234,13 +233,15 @@ func (a *Authority) NewOrder(ctx context.Context, ops OrderOptions) (*Order, err
if err != nil {
return nil, err
}
ops.backdate = a.backdate.Duration
ops.defaultDuration = prov.DefaultTLSCertDuration()
order, err := newOrder(a.db, ops)
if err != nil {
return nil, Wrap(err, "error creating order")
}
return order.toACME(ctx, a.db, a.dir)
return db.CreateOrder(ctx, &Order{
AccountID: ops.AccountID,
ProvisionerID: prov.GetID(),
Backdate: a.backdate.Duration,
DefaultDuration: prov.DefaultTLSCertDuration(),
Identifiers: ops.Identifiers,
NotBefore: ops.NotBefore,
NotAfter: ops.NotAfter,
})
}
// FinalizeOrder attempts to finalize an order and generate a new certificate.
@ -249,44 +250,51 @@ func (a *Authority) FinalizeOrder(ctx context.Context, accID, orderID string, cs
if err != nil {
return nil, err
}
o, err := getOrder(a.db, orderID)
o, err := a.db.GetOrder(ctx, orderID)
if err != nil {
return nil, err
}
if accID != o.AccountID {
log.Printf("account-id from request ('%s') does not match order account-id ('%s')", accID, o.AccountID)
return nil, UnauthorizedErr(errors.New("account does not own order"))
}
o, err = o.finalize(a.db, csr, a.signAuth, prov)
if prov.GetID() != o.ProvisionerID {
log.Printf("provisioner-id from request ('%s') does not match order provisioner-id ('%s')", prov.GetID(), o.ProvisionerID)
return nil, UnauthorizedErr(errors.New("provisioner does not own order"))
}
o, err = o.Finalize(ctx, a.db, csr, a.signAuth, prov)
if err != nil {
return nil, Wrap(err, "error finalizing order")
}
return o.toACME(ctx, a.db, a.dir)
return o, nil
}
// GetAuthz retrieves and attempts to update the status on an ACME authz
// before returning.
func (a *Authority) GetAuthz(ctx context.Context, accID, authzID string) (*Authz, error) {
az, err := getAuthz(a.db, authzID)
az, err := a.db.GetAuthorization(ctx, authzID)
if err != nil {
return nil, err
}
if accID != az.getAccountID() {
if accID != az.AccountID {
log.Printf("account-id from request ('%s') does not match authz account-id ('%s')", accID, az.AccountID)
return nil, UnauthorizedErr(errors.New("account does not own authz"))
}
az, err = az.updateStatus(a.db)
az, err = az.UpdateStatus(ctx, a.db)
if err != nil {
return nil, Wrap(err, "error updating authz status")
}
return az.toACME(ctx, a.db, a.dir)
return az, nil
}
// ValidateChallenge attempts to validate the challenge.
func (a *Authority) ValidateChallenge(ctx context.Context, accID, chID string, jwk *jose.JSONWebKey) (*Challenge, error) {
ch, err := getChallenge(a.db, chID)
ch, err := a.db.GetChallenge(ctx, chID, "todo")
if err != nil {
return nil, err
}
if accID != ch.getAccountID() {
if accID != ch.AccountID {
log.Printf("account-id from request ('%s') does not match challenge account-id ('%s')", accID, ch.AccountID)
return nil, UnauthorizedErr(errors.New("account does not own challenge"))
}
client := http.Client{
@ -295,17 +303,16 @@ func (a *Authority) ValidateChallenge(ctx context.Context, accID, chID string, j
dialer := &net.Dialer{
Timeout: 30 * time.Second,
}
ch, err = ch.validate(a.db, jwk, validateOptions{
if err = ch.Validate(ctx, a.db, jwk, validateOptions{
httpGet: client.Get,
lookupTxt: net.LookupTXT,
tlsDial: func(network, addr string, config *tls.Config) (*tls.Conn, error) {
return tls.DialWithDialer(dialer, network, addr, config)
},
})
if err != nil {
}); err != nil {
return nil, Wrap(err, "error attempting challenge validation")
}
return ch.toACME(ctx, a.db, a.dir)
return ch, nil
}
// GetCertificate retrieves the Certificate by ID.
@ -319,13 +326,3 @@ func (a *Authority) GetCertificate(accID, certID string) ([]byte, error) {
}
return cert.toACME(a.db, a.dir)
}
type httpGetter func(string) (*http.Response, error)
type lookupTxt func(string) ([]string, error)
type tlsDialer func(network, addr string, config *tls.Config) (*tls.Conn, error)
type validateOptions struct {
httpGet httpGetter
lookupTxt lookupTxt
tlsDial tlsDialer
}

75
acme/authorization.go Normal file
View file

@ -0,0 +1,75 @@
package types
import (
"context"
"encoding/json"
"time"
"github.com/pkg/errors"
)
// Authorization representst an ACME Authorization.
type Authorization struct {
Identifier *Identifier `json:"identifier"`
Status string `json:"status"`
Expires string `json:"expires"`
Challenges []*Challenge `json:"challenges"`
Wildcard bool `json:"wildcard"`
ID string `json:"-"`
AccountID string `json:"-"`
}
// ToLog enables response logging.
func (az *Authorization) ToLog() (interface{}, error) {
b, err := json.Marshal(az)
if err != nil {
return nil, ServerInternalErr(errors.Wrap(err, "error marshaling authz for logging"))
}
return string(b), nil
}
// UpdateStatus updates the ACME Authorization Status if necessary.
// Changes to the Authorization are saved using the database interface.
func (az *Authorization) UpdateStatus(ctx context.Context, db DB) error {
now := time.Now().UTC()
expiry, err := time.Parse(time.RFC3339, az.Expires)
if err != nil {
return ServerInternalErr(errors.Wrap("error converting expiry string to time"))
}
switch az.Status {
case StatusInvalid:
return nil
case StatusValid:
return nil
case StatusPending:
// check expiry
if now.After(expiry) {
az.Status = StatusInvalid
az.Error = MalformedErr(errors.New("authz has expired"))
break
}
var isValid = false
for _, chID := range ba.Challenges {
ch, err := db.GetChallenge(ctx, chID, az.ID)
if err != nil {
return ServerInternalErr(err)
}
if ch.Status == StatusValid {
isValid = true
break
}
}
if !isValid {
return nil
}
az.Status = StatusValid
az.Error = nil
default:
return nil, ServerInternalErr(errors.Errorf("unrecognized authz status: %s", ba.Status))
}
return ServerInternalErr(db.UpdateAuthorization(ctx, az))
}

262
acme/challenge.go Normal file
View file

@ -0,0 +1,262 @@
package types
import (
"context"
"crypto"
"crypto/sha256"
"crypto/subtle"
"crypto/tls"
"encoding/asn1"
"encoding/base64"
"encoding/hex"
"encoding/json"
"fmt"
"io/ioutil"
"net"
"net/http"
"strings"
"time"
"github.com/pkg/errors"
"github.com/smallstep/nosql"
"go.step.sm/crypto/jose"
)
// Challenge represents an ACME response Challenge type.
type Challenge struct {
Type string `json:"type"`
Status string `json:"status"`
Token string `json:"token"`
Validated string `json:"validated,omitempty"`
URL string `json:"url"`
Error *AError `json:"error,omitempty"`
ID string `json:"-"`
AuthzID string `json:"-"`
AccountID string `json:"-"`
Value string `json:"-"`
}
// ToLog enables response logging.
func (ch *Challenge) ToLog() (interface{}, error) {
b, err := json.Marshal(ch)
if err != nil {
return nil, ServerInternalErr(errors.Wrap(err, "error marshaling challenge for logging"))
}
return string(b), nil
}
// Validate attempts to validate the challenge. Stores changes to the Challenge
// type using the DB interface.
// satisfactorily validated, the 'status' and 'validated' attributes are
// updated.
func (ch *Challenge) Validate(ctx context.Context, db DB, jwk *jose.JSONWebKey, vo validateOptions) error {
// If already valid or invalid then return without performing validation.
if ch.Status == StatusValid || ch.Status == StatusInvalid {
return nil
}
switch ch.Type {
case "http-01":
return http01Validate(ctx, ch, db, jwk, vo)
case "dns-01":
return dns01Validate(ctx, ch, db, jwk, vo)
case "tls-alpn-01":
return tlsalpn01Validate(ctx, ch, db, jwk, vo)
default:
return ServerInternalErr(errors.Errorf("unexpected challenge type '%s'", ch.Type))
}
}
func http01Validate(ctx context.Context, ch *Challenge, db DB, jwk *jose.JSONWebKey, vo validateOptions) error {
url := fmt.Sprintf("http://%s/.well-known/acme-challenge/%s", ch.Value, ch.Token)
resp, err := vo.httpGet(url)
if err != nil {
return storeError(ctx, ch, db, ConnectionErr(errors.Wrapf(err,
"error doing http GET for url %s", url)))
}
if resp.StatusCode >= 400 {
return storeError(ctx, ch, db, ConnectionErr(errors.Errorf("error doing http GET for url %s with status code %d",
url, resp.StatusCode)))
}
defer resp.Body.Close()
body, err := ioutil.ReadAll(resp.Body)
if err != nil {
return ServerInternalErr(errors.Wrapf(err, "error reading "+
"response body for url %s", url))
}
keyAuth := strings.Trim(string(body), "\r\n")
expected, err := KeyAuthorization(ch.Token, jwk)
if err != nil {
return err
}
if keyAuth != expected {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("keyAuthorization does not match; "+
"expected %s, but got %s", expected, keyAuth)))
}
// Update and store the challenge.
ch.Status = StatusValid
ch.Error = nil
ch.Validated = clock.Now()
return ServerInternalErr(db.UpdateChallenge(ctx, ch))
}
func tlsalpn01Validate(ctx context.Context, ch *Challenge, db DB, jwk *jose.JSONWebKey, vo validateOptions) error {
config := &tls.Config{
NextProtos: []string{"acme-tls/1"},
ServerName: tc.Value,
InsecureSkipVerify: true, // we expect a self-signed challenge certificate
}
hostPort := net.JoinHostPort(tc.Value, "443")
conn, err := vo.tlsDial("tcp", hostPort, config)
if err != nil {
return storeError(ctx, ch, db, ConnectionErr(errors.Wrapf(err,
"error doing TLS dial for %s", hostPort)))
}
defer conn.Close()
cs := conn.ConnectionState()
certs := cs.PeerCertificates
if len(certs) == 0 {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("%s "+
"challenge for %s resulted in no certificates", tc.Type, tc.Value)))
}
if !cs.NegotiatedProtocolIsMutual || cs.NegotiatedProtocol != "acme-tls/1" {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("cannot "+
"negotiate ALPN acme-tls/1 protocol for tls-alpn-01 challenge")))
}
leafCert := certs[0]
if len(leafCert.DNSNames) != 1 || !strings.EqualFold(leafCert.DNSNames[0], tc.Value) {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
"leaf certificate must contain a single DNS name, %v", tc.Value)))
}
idPeAcmeIdentifier := asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 31}
idPeAcmeIdentifierV1Obsolete := asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 30, 1}
foundIDPeAcmeIdentifierV1Obsolete := false
keyAuth, err := KeyAuthorization(tc.Token, jwk)
if err != nil {
return nil, err
}
hashedKeyAuth := sha256.Sum256([]byte(keyAuth))
for _, ext := range leafCert.Extensions {
if idPeAcmeIdentifier.Equal(ext.Id) {
if !ext.Critical {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("incorrect "+
"certificate for tls-alpn-01 challenge: acmeValidationV1 extension not critical")))
}
var extValue []byte
rest, err := asn1.Unmarshal(ext.Value, &extValue)
if err != nil || len(rest) > 0 || len(hashedKeyAuth) != len(extValue) {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("incorrect "+
"certificate for tls-alpn-01 challenge: malformed acmeValidationV1 extension value")))
}
if subtle.ConstantTimeCompare(hashedKeyAuth[:], extValue) != 1 {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
"expected acmeValidationV1 extension value %s for this challenge but got %s",
hex.EncodeToString(hashedKeyAuth[:]), hex.EncodeToString(extValue))))
}
ch.Status = StatusValid
ch.Error = nil
ch.Validated = clock.Now()
return ServerInternalErr(db.UpdateChallenge(ctx, ch))
}
if idPeAcmeIdentifierV1Obsolete.Equal(ext.Id) {
foundIDPeAcmeIdentifierV1Obsolete = true
}
}
if foundIDPeAcmeIdentifierV1Obsolete {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("incorrect "+
"certificate for tls-alpn-01 challenge: obsolete id-pe-acmeIdentifier in acmeValidationV1 extension")))
}
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("incorrect "+
"certificate for tls-alpn-01 challenge: missing acmeValidationV1 extension")))
}
func dns01Validate(ctx context.Context, ch *Challenge, db nosql.DB, jwk *jose.JSONWebKey, vo validateOptions) error {
// Normalize domain for wildcard DNS names
// This is done to avoid making TXT lookups for domains like
// _acme-challenge.*.example.com
// Instead perform txt lookup for _acme-challenge.example.com
domain := strings.TrimPrefix(dc.Value, "*.")
txtRecords, err := vo.lookupTxt("_acme-challenge." + domain)
if err != nil {
return storeError(ctx, ch, db, DNSErr(errors.Wrapf(err, "error looking up TXT "+
"records for domain %s", domain)))
}
expectedKeyAuth, err := KeyAuthorization(dc.Token, jwk)
if err != nil {
return nil, err
}
h := sha256.Sum256([]byte(expectedKeyAuth))
expected := base64.RawURLEncoding.EncodeToString(h[:])
var found bool
for _, r := range txtRecords {
if r == expected {
found = true
break
}
}
if !found {
return storeError(ctx, ch, db, RejectedIdentifierErr(errors.Errorf("keyAuthorization "+
"does not match; expected %s, but got %s", expectedKeyAuth, txtRecords)))
}
// Update and store the challenge.
ch.Status = StatusValid
ch.Error = nil
ch.Validated = time.Now().UTC()
return ServerInternalErr(db.UpdateChallenge(ctx, ch))
}
// KeyAuthorization creates the ACME key authorization value from a token
// and a jwk.
func KeyAuthorization(token string, jwk *jose.JSONWebKey) (string, error) {
thumbprint, err := jwk.Thumbprint(crypto.SHA256)
if err != nil {
return "", ServerInternalErr(errors.Wrap(err, "error generating JWK thumbprint"))
}
encPrint := base64.RawURLEncoding.EncodeToString(thumbprint)
return fmt.Sprintf("%s.%s", token, encPrint), nil
}
// storeError the given error to an ACME error and saves using the DB interface.
func (bc *baseChallenge) storeError(ctx context.Context, ch Challenge, db nosql.DB, err *Error) error {
ch.Error = err.ToACME()
if err := db.UpdateChallenge(ctx, ch); err != nil {
return ServerInternalErr(errors.Wrap(err, "failure saving error to acme challenge"))
}
return nil
}
type httpGetter func(string) (*http.Response, error)
type lookupTxt func(string) ([]string, error)
type tlsDialer func(network, addr string, config *tls.Config) (*tls.Conn, error)
type validateOptions struct {
httpGet httpGetter
lookupTxt lookupTxt
tlsDial tlsDialer
}

11
acme/common.go
View file

@ -16,6 +16,7 @@ import (
// only those methods required by the ACME api/authority.
type Provisioner interface {
AuthorizeSign(ctx context.Context, token string) ([]provisioner.SignOption, error)
GetID() string
GetName() string
DefaultTLSCertDuration() time.Duration
GetOptions() *provisioner.Options
@ -25,6 +26,7 @@ type Provisioner interface {
type MockProvisioner struct {
Mret1 interface{}
Merr error
MgetID func() string
MgetName func() string
MauthorizeSign func(ctx context.Context, ott string) ([]provisioner.SignOption, error)
MdefaultTLSCertDuration func() time.Duration
@ -55,6 +57,7 @@ func (m *MockProvisioner) DefaultTLSCertDuration() time.Duration {
return m.Mret1.(time.Duration)
}
// GetOptions mock
func (m *MockProvisioner) GetOptions() *provisioner.Options {
if m.MgetOptions != nil {
return m.MgetOptions()
@ -62,6 +65,14 @@ func (m *MockProvisioner) GetOptions() *provisioner.Options {
return m.Mret1.(*provisioner.Options)
}
// GetID mock
func (m *MockProvisioner) GetID() string {
if m.MgetID != nil {
return m.MgetID()
}
return m.Mret1.(string)
}
// ContextKey is the key type for storing and searching for ACME request
// essentials in the context of a request.
type ContextKey string

0
acme/db/db.go → acme/db.go
View file

52
acme/db/nosql/account.go
View file

@ -25,45 +25,15 @@ func (dba *dbAccount) clone() *dbAccount {
return &nu
}
func (db *DB) saveDBAccount(nu *dbAccount, old *dbAccount) error {
var (
err error
oldB []byte
)
if old == nil {
oldB = nil
} else {
if oldB, err = json.Marshal(old); err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling old acme order"))
}
}
b, err := json.Marshal(*nu)
if err != nil {
return errors.Wrap(err, "error marshaling new account object")
}
// Set the Account
_, swapped, err := db.CmpAndSwap(accountTable, []byte(nu.ID), oldB, b)
switch {
case err != nil:
return ServerInternalErr(errors.Wrap(err, "error storing account"))
case !swapped:
return ServerInternalErr(errors.New("error storing account; " +
"value has changed since last read"))
default:
return nil
}
}
// CreateAccount imlements the AcmeDB.CreateAccount interface.
func (db *DB) CreateAccount(ctx context.Context, acc *types.Account) error {
id, err := randID()
acc.ID, err = randID()
if err != nil {
return nil, err
}
dba := &dbAccount{
ID: id,
ID: acc.ID,
Key: acc.Key,
Contact: acc.Contact,
Status: acc.Valid,
@ -84,7 +54,7 @@ func (db *DB) CreateAccount(ctx context.Context, acc *types.Account) error {
case !swapped:
return ServerInternalErr(errors.Errorf("key-id to account-id index already exists"))
default:
if err = db.saveDBAccount(dba, nil); err != nil {
if err = db.save(ctx, acc.ID, dba, nil, "account", accountTable); err != nil {
db.db.Del(accountByKeyIDTable, kidB)
return err
}
@ -115,9 +85,11 @@ func (db *DB) GetAccountByKeyID(ctx context.Context, kid string) (*types.Account
// UpdateAccount imlements the AcmeDB.UpdateAccount interface.
func (db *DB) UpdateAccount(ctx context.Context, acc *types.Account) error {
kid := "from-context"
if len(acc.ID) == 0 {
return ServerInternalErr(errors.New("id cannot be empty"))
}
old, err := db.getDBAccountByKeyID(ctx, kid)
old, err := db.getDBAccount(ctx, acc.ID)
if err != nil {
return err
}
@ -131,7 +103,7 @@ func (db *DB) UpdateAccount(ctx context.Context, acc *types.Account) error {
nu.Deactivated = clock.Now()
}
return db.saveDBAccount(newdba, dba)
return db.save(ctx, old.ID, newdba, dba, "account", accountTable)
}
func (db *DB) getAccountIDByKeyID(ctx context.Context, kid string) (string, error) {
@ -145,12 +117,8 @@ func (db *DB) getAccountIDByKeyID(ctx context.Context, kid string) (string, erro
return string(id), nil
}
// getDBAccountByKeyID retrieves Id associated with the given Kid.
func (db *DB) getDBAccountByKeyID(ctx context.Context, kid string) (*dbAccount, error) {
id, err := db.getAccountIDByKeyID(ctx, kid)
if err != nil {
return err
}
// getDBAccount retrieves and unmarshals dbAccount.
func (db *DB) getDBAccount(ctx context.Context, id string) (*dbAccount, error) {
data, err := db.db.Get(accountTable, []byte(id))
if err != nil {
if nosqlDB.IsErrNotFound(err) {

94
acme/db/nosql/authz.go
View file

@ -16,7 +16,7 @@ var defaultExpiryDuration = time.Hour * 24
type dbAuthz struct {
ID string `json:"id"`
AccountID string `json:"accountID"`
Identifier Identifier `json:"identifier"`
Identifier *Identifier `json:"identifier"`
Status string `json:"status"`
Expires time.Time `json:"expires"`
Challenges []string `json:"challenges"`
@ -30,34 +30,6 @@ func (ba *dbAuthz) clone() *dbAuthz {
return &u
}
func (db *DB) saveDBAuthz(ctx context.Context, nu *authz, old *dbAuthz) error {
var (
err error
oldB, newB []byte
)
if old == nil {
oldB = nil
} else {
if oldB, err = json.Marshal(old); err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling old authz"))
}
}
if newB, err = json.Marshal(nu); err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling new authz"))
}
_, swapped, err := db.CmpAndSwap(authzTable, []byte(ba.ID), oldB, newB)
switch {
case err != nil:
return ServerInternalErr(errors.Wrapf(err, "error storing authz"))
case !swapped:
return ServerInternalErr(errors.Errorf("error storing authz; " +
"value has changed since last read"))
default:
return nil
}
}
// getDBAuthz retrieves and unmarshals a database representation of the
// ACME Authorization type.
func (db *DB) getDBAuthz(ctx context.Context, id string) (*dbAuthz, error) {
@ -102,8 +74,11 @@ func (db *DB) GetAuthorization(ctx context.Context, id string) (*types.Authoriza
// CreateAuthorization creates an entry in the database for the Authorization.
// Implements the acme.DB.CreateAuthorization interface.
func (db *DB) CreateAuthorization(ctx context.Context, az *types.Authorization) error {
if len(authz.AccountID) == 0 {
return ServerInternalErr(errors.New("AccountID cannot be empty"))
if len(az.AccountID) == 0 {
return ServerInternalErr(errors.New("account-id cannot be empty"))
}
if az.Identifier == nil {
return ServerInternalErr(errors.New("identifier cannot be nil"))
}
az.ID, err = randID()
if err != nil {
@ -113,7 +88,7 @@ func (db *DB) CreateAuthorization(ctx context.Context, az *types.Authorization)
now := clock.Now()
dbaz := &dbAuthz{
ID: az.ID,
AccountID: az.AccountId,
AccountID: az.AccountID,
Status: types.StatusPending,
Created: now,
Expires: now.Add(defaultExpiryDuration),
@ -150,11 +125,14 @@ func (db *DB) CreateAuthorization(ctx context.Context, az *types.Authorization)
}
dbaz.Challenges = chIDs
return db.saveDBAuthz(ctx, dbaz, nil)
return db.save(ctx, az.ID, dbaz, nil, "authz", authzTable)
}
// UpdateAuthorization saves an updated ACME Authorization to the database.
func (db *DB) UpdateAuthorization(ctx context.Context, az *types.Authorization) error {
if len(az.ID) == 0 {
return ServerInternalErr(errors.New("id cannot be empty"))
}
old, err := db.getDBAuthz(ctx, az.ID)
if err != nil {
return err
@ -164,53 +142,5 @@ func (db *DB) UpdateAuthorization(ctx context.Context, az *types.Authorization)
nu.Status = az.Status
nu.Error = az.Error
return db.saveDBAuthz(ctx, nu, old)
return db.save(ctx, old.ID, nu, old, "authz", authzTable)
}
/*
// updateStatus attempts to update the status on a dbAuthz and stores the
// updating object if necessary.
func (ba *dbAuthz) updateStatus(db nosql.DB) (authz, error) {
newAuthz := ba.clone()
now := time.Now().UTC()
switch ba.Status {
case StatusInvalid:
return ba.parent(), nil
case StatusValid:
return ba.parent(), nil
case StatusPending:
// check expiry
if now.After(ba.Expires) {
newAuthz.Status = StatusInvalid
newAuthz.Error = MalformedErr(errors.New("authz has expired"))
break
}
var isValid = false
for _, chID := range ba.Challenges {
ch, err := getChallenge(db, chID)
if err != nil {
return ba, err
}
if ch.getStatus() == StatusValid {
isValid = true
break
}
}
if !isValid {
return ba.parent(), nil
}
newAuthz.Status = StatusValid
newAuthz.Error = nil
default:
return nil, ServerInternalErr(errors.Errorf("unrecognized authz status: %s", ba.Status))
}
if err := newAuthz.save(db, ba); err != nil {
return ba, err
}
return newAuthz.parent(), nil
}
*/

403
acme/db/nosql/challenge.go
View file

@ -35,39 +35,6 @@ func (dbc *dbChallenge) clone() *dbChallenge {
return &u
}
// save writes the challenge to disk. For new challenges 'old' should be nil,
// otherwise 'old' should be a pointer to the acme challenge as it was at the
// start of the request. This method will fail if the value currently found
// in the bucket/row does not match the value of 'old'.
func (db *DB) saveDBChallenge(ctx context.Context, nu challenge, old challenge) error {
newB, err := json.Marshal(nu)
if err != nil {
return ServerInternalErr(errors.Wrap(err,
"error marshaling new acme challenge"))
}
var oldB []byte
if old == nil {
oldB = nil
} else {
oldB, err = json.Marshal(old)
if err != nil {
return ServerInternalErr(errors.Wrap(err,
"error marshaling old acme challenge"))
}
}
_, swapped, err := db.CmpAndSwap(challengeTable, []byte(bc.ID), oldB, newB)
switch {
case err != nil:
return ServerInternalErr(errors.Wrap(err, "error saving acme challenge"))
case !swapped:
return ServerInternalErr(errors.New("error saving acme challenge; " +
"acme challenge has changed since last read"))
default:
return nil
}
}
func (db *DB) getDBChallenge(ctx context.Context, id string) (*dbChallenge, error) {
data, err := db.db.Get(challengeTable, []byte(id))
if nosql.IsErrNotFound(err) {
@ -121,7 +88,7 @@ func (db *DB) CreateChallenge(ctx context.context, ch *types.Challenge) error {
Type: ch.Type,
}
return dbch.saveDBChallenge(ctx, dbch, nil)
return dbch.save(ctx, ch.ID, dbch, nil, "challenge", challengeTable)
}
// GetChallenge retrieves and unmarshals an ACME challenge type from the database.
@ -149,7 +116,10 @@ func (db *DB) GetChallenge(ctx context.Context, id, authzID string) (*types.Chal
// UpdateChallenge updates an ACME challenge type in the database.
func (db *DB) UpdateChallenge(ctx context.Context, ch *types.Challenge) error {
old, err := db.getDBChallenge(ctx, id)
if len(ch.ID) == 0 {
return ServerInternalErr(errors.New("id cannot be empty"))
}
old, err := db.getDBChallenge(ctx, ch.ID)
if err != nil {
return err
}
@ -163,366 +133,5 @@ func (db *DB) UpdateChallenge(ctx context.Context, ch *types.Challenge) error {
nu.Validated = clock.Now()
}
return db.saveDBChallenge(ctx, nu, old)
return db.save(ctx, old.ID, nu, old, "challenge", challengeTable)
}
//// http01Challenge represents an http-01 acme challenge.
//type http01Challenge struct {
// *baseChallenge
//}
//
//// newHTTP01Challenge returns a new acme http-01 challenge.
//func newHTTP01Challenge(db nosql.DB, ops ChallengeOptions) (challenge, error) {
// bc, err := newBaseChallenge(ops.AccountID, ops.AuthzID)
// if err != nil {
// return nil, err
// }
// bc.Type = "http-01"
// bc.Value = ops.Identifier.Value
//
// hc := &http01Challenge{bc}
// if err := hc.save(db, nil); err != nil {
// return nil, err
// }
// return hc, nil
//}
//
//// Validate attempts to validate the challenge. If the challenge has been
//// satisfactorily validated, the 'status' and 'validated' attributes are
//// updated.
//func (hc *http01Challenge) validate(db nosql.DB, jwk *jose.JSONWebKey, vo validateOptions) (challenge, error) {
// // If already valid or invalid then return without performing validation.
// if hc.getStatus() == StatusValid || hc.getStatus() == StatusInvalid {
// return hc, nil
// }
// url := fmt.Sprintf("http://%s/.well-known/acme-challenge/%s", hc.Value, hc.Token)
//
// resp, err := vo.httpGet(url)
// if err != nil {
// if err = hc.storeError(db, ConnectionErr(errors.Wrapf(err,
// "error doing http GET for url %s", url))); err != nil {
// return nil, err
// }
// return hc, nil
// }
// if resp.StatusCode >= 400 {
// if err = hc.storeError(db,
// ConnectionErr(errors.Errorf("error doing http GET for url %s with status code %d",
// url, resp.StatusCode))); err != nil {
// return nil, err
// }
// return hc, nil
// }
// defer resp.Body.Close()
//
// body, err := ioutil.ReadAll(resp.Body)
// if err != nil {
// return nil, ServerInternalErr(errors.Wrapf(err, "error reading "+
// "response body for url %s", url))
// }
// keyAuth := strings.Trim(string(body), "\r\n")
//
// expected, err := KeyAuthorization(hc.Token, jwk)
// if err != nil {
// return nil, err
// }
// if keyAuth != expected {
// if err = hc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("keyAuthorization does not match; "+
// "expected %s, but got %s", expected, keyAuth))); err != nil {
// return nil, err
// }
// return hc, nil
// }
//
// // Update and store the challenge.
// upd := &http01Challenge{hc.baseChallenge.clone()}
// upd.Status = StatusValid
// upd.Error = nil
// upd.Validated = clock.Now()
//
// if err := upd.save(db, hc); err != nil {
// return nil, err
// }
// return upd, nil
//}
//
//type tlsALPN01Challenge struct {
// *baseChallenge
//}
//
//// newTLSALPN01Challenge returns a new acme tls-alpn-01 challenge.
//func newTLSALPN01Challenge(db nosql.DB, ops ChallengeOptions) (challenge, error) {
// bc, err := newBaseChallenge(ops.AccountID, ops.AuthzID)
// if err != nil {
// return nil, err
// }
// bc.Type = "tls-alpn-01"
// bc.Value = ops.Identifier.Value
//
// hc := &tlsALPN01Challenge{bc}
// if err := hc.save(db, nil); err != nil {
// return nil, err
// }
// return hc, nil
//}
//
//func (tc *tlsALPN01Challenge) validate(db nosql.DB, jwk *jose.JSONWebKey, vo validateOptions) (challenge, error) {
// // If already valid or invalid then return without performing validation.
// if tc.getStatus() == StatusValid || tc.getStatus() == StatusInvalid {
// return tc, nil
// }
//
// config := &tls.Config{
// NextProtos: []string{"acme-tls/1"},
// ServerName: tc.Value,
// InsecureSkipVerify: true, // we expect a self-signed challenge certificate
// }
//
// hostPort := net.JoinHostPort(tc.Value, "443")
//
// conn, err := vo.tlsDial("tcp", hostPort, config)
// if err != nil {
// if err = tc.storeError(db,
// ConnectionErr(errors.Wrapf(err, "error doing TLS dial for %s", hostPort))); err != nil {
// return nil, err
// }
// return tc, nil
// }
// defer conn.Close()
//
// cs := conn.ConnectionState()
// certs := cs.PeerCertificates
//
// if len(certs) == 0 {
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("%s challenge for %s resulted in no certificates",
// tc.Type, tc.Value))); err != nil {
// return nil, err
// }
// return tc, nil
// }
//
// if !cs.NegotiatedProtocolIsMutual || cs.NegotiatedProtocol != "acme-tls/1" {
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("cannot negotiate ALPN acme-tls/1 protocol for "+
// "tls-alpn-01 challenge"))); err != nil {
// return nil, err
// }
// return tc, nil
// }
//
// leafCert := certs[0]
//
// if len(leafCert.DNSNames) != 1 || !strings.EqualFold(leafCert.DNSNames[0], tc.Value) {
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
// "leaf certificate must contain a single DNS name, %v", tc.Value))); err != nil {
// return nil, err
// }
// return tc, nil
// }
//
// idPeAcmeIdentifier := asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 31}
// idPeAcmeIdentifierV1Obsolete := asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 30, 1}
// foundIDPeAcmeIdentifierV1Obsolete := false
//
// keyAuth, err := KeyAuthorization(tc.Token, jwk)
// if err != nil {
// return nil, err
// }
// hashedKeyAuth := sha256.Sum256([]byte(keyAuth))
//
// for _, ext := range leafCert.Extensions {
// if idPeAcmeIdentifier.Equal(ext.Id) {
// if !ext.Critical {
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
// "acmeValidationV1 extension not critical"))); err != nil {
// return nil, err
// }
// return tc, nil
// }
//
// var extValue []byte
// rest, err := asn1.Unmarshal(ext.Value, &extValue)
//
// if err != nil || len(rest) > 0 || len(hashedKeyAuth) != len(extValue) {
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
// "malformed acmeValidationV1 extension value"))); err != nil {
// return nil, err
// }
// return tc, nil
// }
//
// if subtle.ConstantTimeCompare(hashedKeyAuth[:], extValue) != 1 {
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
// "expected acmeValidationV1 extension value %s for this challenge but got %s",
// hex.EncodeToString(hashedKeyAuth[:]), hex.EncodeToString(extValue)))); err != nil {
// return nil, err
// }
// return tc, nil
// }
//
// upd := &tlsALPN01Challenge{tc.baseChallenge.clone()}
// upd.Status = StatusValid
// upd.Error = nil
// upd.Validated = clock.Now()
//
// if err := upd.save(db, tc); err != nil {
// return nil, err
// }
// return upd, nil
// }
//
// if idPeAcmeIdentifierV1Obsolete.Equal(ext.Id) {
// foundIDPeAcmeIdentifierV1Obsolete = true
// }
// }
//
// if foundIDPeAcmeIdentifierV1Obsolete {
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
// "obsolete id-pe-acmeIdentifier in acmeValidationV1 extension"))); err != nil {
// return nil, err
// }
// return tc, nil
// }
//
// if err = tc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("incorrect certificate for tls-alpn-01 challenge: "+
// "missing acmeValidationV1 extension"))); err != nil {
// return nil, err
// }
// return tc, nil
//}
//
//// dns01Challenge represents an dns-01 acme challenge.
//type dns01Challenge struct {
// *baseChallenge
//}
//
//// newDNS01Challenge returns a new acme dns-01 challenge.
//func newDNS01Challenge(db nosql.DB, ops ChallengeOptions) (challenge, error) {
// bc, err := newBaseChallenge(ops.AccountID, ops.AuthzID)
// if err != nil {
// return nil, err
// }
// bc.Type = "dns-01"
// bc.Value = ops.Identifier.Value
//
// dc := &dns01Challenge{bc}
// if err := dc.save(db, nil); err != nil {
// return nil, err
// }
// return dc, nil
//}
//
//// KeyAuthorization creates the ACME key authorization value from a token
//// and a jwk.
//func KeyAuthorization(token string, jwk *jose.JSONWebKey) (string, error) {
// thumbprint, err := jwk.Thumbprint(crypto.SHA256)
// if err != nil {
// return "", ServerInternalErr(errors.Wrap(err, "error generating JWK thumbprint"))
// }
// encPrint := base64.RawURLEncoding.EncodeToString(thumbprint)
// return fmt.Sprintf("%s.%s", token, encPrint), nil
//}
//
//// validate attempts to validate the challenge. If the challenge has been
//// satisfactorily validated, the 'status' and 'validated' attributes are
//// updated.
//func (dc *dns01Challenge) validate(db nosql.DB, jwk *jose.JSONWebKey, vo validateOptions) (challenge, error) {
// // If already valid or invalid then return without performing validation.
// if dc.getStatus() == StatusValid || dc.getStatus() == StatusInvalid {
// return dc, nil
// }
//
// // Normalize domain for wildcard DNS names
// // This is done to avoid making TXT lookups for domains like
// // _acme-challenge.*.example.com
// // Instead perform txt lookup for _acme-challenge.example.com
// domain := strings.TrimPrefix(dc.Value, "*.")
//
// txtRecords, err := vo.lookupTxt("_acme-challenge." + domain)
// if err != nil {
// if err = dc.storeError(db,
// DNSErr(errors.Wrapf(err, "error looking up TXT "+
// "records for domain %s", domain))); err != nil {
// return nil, err
// }
// return dc, nil
// }
//
// expectedKeyAuth, err := KeyAuthorization(dc.Token, jwk)
// if err != nil {
// return nil, err
// }
// h := sha256.Sum256([]byte(expectedKeyAuth))
// expected := base64.RawURLEncoding.EncodeToString(h[:])
// var found bool
// for _, r := range txtRecords {
// if r == expected {
// found = true
// break
// }
// }
// if !found {
// if err = dc.storeError(db,
// RejectedIdentifierErr(errors.Errorf("keyAuthorization "+
// "does not match; expected %s, but got %s", expectedKeyAuth, txtRecords))); err != nil {
// return nil, err
// }
// return dc, nil
// }
//
// // Update and store the challenge.
// upd := &dns01Challenge{dc.baseChallenge.clone()}
// upd.Status = StatusValid
// upd.Error = nil
// upd.Validated = time.Now().UTC()
//
// if err := upd.save(db, dc); err != nil {
// return nil, err
// }
// return upd, nil
//}
//
//// unmarshalChallenge unmarshals a challenge type into the correct sub-type.
//func unmarshalChallenge(data []byte) (challenge, error) {
// var getType struct {
// Type string `json:"type"`
// }
// if err := json.Unmarshal(data, &getType); err != nil {
// return nil, ServerInternalErr(errors.Wrap(err, "error unmarshaling challenge type"))
// }
//
// switch getType.Type {
// case "dns-01":
// var bc baseChallenge
// if err := json.Unmarshal(data, &bc); err != nil {
// return nil, ServerInternalErr(errors.Wrap(err, "error unmarshaling "+
// "challenge type into dns01Challenge"))
// }
// return &dns01Challenge{&bc}, nil
// case "http-01":
// var bc baseChallenge
// if err := json.Unmarshal(data, &bc); err != nil {
// return nil, ServerInternalErr(errors.Wrap(err, "error unmarshaling "+
// "challenge type into http01Challenge"))
// }
// return &http01Challenge{&bc}, nil
// case "tls-alpn-01":
// var bc baseChallenge
// if err := json.Unmarshal(data, &bc); err != nil {
// return nil, ServerInternalErr(errors.Wrap(err, "error unmarshaling "+
// "challenge type into tlsALPN01Challenge"))
// }
// return &tlsALPN01Challenge{&bc}, nil
// default:
// return nil, ServerInternalErr(errors.Errorf("unexpected challenge type '%s'", getType.Type))
// }
//}
//

12
acme/db/nosql/nonce.go
View file

@ -33,16 +33,10 @@ func (db *DB) CreateNonce() (Nonce, error) {
if err != nil {
return nil, ServerInternalErr(errors.Wrap(err, "error marshaling nonce"))
}
_, swapped, err := db.CmpAndSwap(nonceTable, []byte(id), nil, b)
switch {
case err != nil:
return nil, ServerInternalErr(errors.Wrap(err, "error storing nonce"))
case !swapped:
return nil, ServerInternalErr(errors.New("error storing nonce; " +
"value has changed since last read"))
default:
return Nonce(id), nil
if err = db.save(ctx, id, b, nil, "nonce", nonceTable); err != nil {
return "", err
}
return Nonce(id), nil
}
// DeleteNonce verifies that the nonce is valid (by checking if it exists),

46
acme/db/nosql/nosql.go
View file

@ -1,10 +1,56 @@
package nosql
import (
"context"
"encoding/json"
"github.com/pkg/errors"
nosqlDB "github.com/smallstep/nosql"
)
var (
accountTable = []byte("acme_accounts")
accountByKeyIDTable = []byte("acme_keyID_accountID_index")
authzTable = []byte("acme_authzs")
challengeTable = []byte("acme_challenges")
nonceTable = []byte("nonces")
orderTable = []byte("acme_orders")
ordersByAccountIDTable = []byte("acme_account_orders_index")
certTable = []byte("acme_certs")
)
// DB is a struct that implements the AcmeDB interface.
type DB struct {
db nosqlDB.DB
}
// save writes the new data to the database, overwriting the old data if it
// existed.
func (db *DB) save(ctx context.Context, id string, nu interface{}, old interface{}, typ string, table []byte) error {
newB, err := json.Marshal(nu)
if err != nil {
return ServerInternalErr(errors.Wrapf(err,
"error marshaling new acme %s", typ))
}
var oldB []byte
if old == nil {
oldB = nil
} else {
oldB, err = json.Marshal(old)
if err != nil {
return ServerInternalErr(errors.Wrapf(err,
"error marshaling old acme %s", typ))
}
}
_, swapped, err := db.CmpAndSwap(table, []byte(id), oldB, newB)
switch {
case err != nil:
return ServerInternalErr(errors.Wrapf(err, "error saving acme %s", typ))
case !swapped:
return ServerInternalErr(errors.Errorf("error saving acme %s; "+
"changed since last read", typ))
default:
return nil
}
}

298
acme/db/nosql/order.go
View file

@ -2,17 +2,13 @@ package nosql
import (
"context"
"crypto/x509"
"encoding/json"
"sort"
"strings"
"sync"
"time"
"github.com/pkg/errors"
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/certificates/acme"
"github.com/smallstep/nosql"
"go.step.sm/crypto/x509util"
)
var defaultOrderExpiry = time.Hour * 24
@ -20,19 +16,10 @@ var defaultOrderExpiry = time.Hour * 24
// Mutex for locking ordersByAccount index operations.
var ordersByAccountMux sync.Mutex
// OrderOptions options with which to create a new Order.
type OrderOptions struct {
AccountID string `json:"accID"`
Identifiers []Identifier `json:"identifiers"`
NotBefore time.Time `json:"notBefore"`
NotAfter time.Time `json:"notAfter"`
backdate time.Duration
defaultDuration time.Duration
}
type dbOrder struct {
ID string `json:"id"`
AccountID string `json:"accountID"`
ProvisionerID string `json:"provisionerID"`
Created time.Time `json:"created"`
Expires time.Time `json:"expires,omitempty"`
Status string `json:"status"`
@ -60,7 +47,7 @@ func (db *DB) getDBOrder(id string) (*dbOrder, error) {
}
// GetOrder retrieves an ACME Order from the database.
func (db *DB) GetOrder(id string) (*types.Order, error) {
func (db *DB) GetOrder(id string) (*acme.Order, error) {
dbo, err := db.getDBOrder(id)
azs := make([]string, len(dbo.Authorizations))
@ -76,6 +63,7 @@ func (db *DB) GetOrder(id string) (*types.Order, error) {
Authorizations: azs,
Finalize: dir.getLink(ctx, FinalizeLink, true, o.ID),
ID: dbo.ID,
ProvisionerID: dbo.ProvisionerID,
}
if dbo.Certificate != "" {
@ -84,60 +72,74 @@ func (db *DB) GetOrder(id string) (*types.Order, error) {
return o, nil
}
func (db *DB) CreateOrder(ctx context.Context, o *types.Order) error {
o.ID, err := randID()
// CreateOrder creates ACME Order resources and saves them to the DB.
func (db *DB) CreateOrder(ctx context.Context, o *acme.Order) error {
if len(o.AccountID) == 0 {
return ServerInternalErr(errors.New("account-id cannot be empty"))
}
if len(o.ProvisionerID) == 0 {
return ServerInternalErr(errors.New("provisioner-id cannot be empty"))
}
if len(o.Identifiers) == 0 {
return ServerInternalErr(errors.New("identifiers cannot be empty"))
}
if o.DefaultDuration == 0 {
return ServerInternalErr(errors.New("default-duration cannot be empty"))
}
o.ID, err = randID()
if err != nil {
return nil, err
}
authzs := make([]string, len(ops.Identifiers))
azIDs := make([]string, len(ops.Identifiers))
for i, identifier := range ops.Identifiers {
az, err := newAuthz(db, ops.AccountID, identifier)
az, err = db.CreateAuthorzation(&types.Authorization{
AccountID: o.AccountID,
Identifier: o.Identifier,
})
if err != nil {
return nil, err
return err
}
authzs[i] = az.getID()
azIDs[i] = az.ID
}
now := clock.Now()
var backdate time.Duration
nbf := ops.NotBefore
nbf := o.NotBefore
if nbf.IsZero() {
nbf = now
backdate = -1 * ops.backdate
backdate = -1 * o.Backdate
}
naf := ops.NotAfter
naf := o.NotAfter
if naf.IsZero() {
naf = nbf.Add(ops.defaultDuration)
naf = nbf.Add(o.DefaultDuration)
}
dbo := &dbOrder{
ID: id,
AccountID: ops.AccountID,
ID: o.ID,
AccountID: o.AccountID,
ProvisionerID: o.ProvisionerID,
Created: now,
Status: StatusPending,
Expires: now.Add(defaultOrderExpiry),
Identifiers: ops.Identifiers,
NotBefore: nbf.Add(backdate),
NotAfter: naf,
Authorizations: authzs,
Authorizations: azIDs,
}
if err := db.saveDBOrder(dbo, nil); err != nil {
if err := db.save(ctx, o.ID, dbo, nil, orderTable); err != nil {
return nil, err
}
var oidHelper = orderIDsByAccount{}
_, err = oidHelper.addOrderID(db, ops.AccountID, o.ID)
_, err = oidHelper.addOrderID(db, o.AccountID, o.ID)
if err != nil {
return nil, err
}
return o, nil
}
// newOrder returns a new Order type.
func newOrder(db nosql.DB, ops OrderOptions) (*order, error) {
}
type orderIDsByAccount struct{}
// addOrderID adds an order ID to a users index of in progress order IDs.
@ -188,7 +190,7 @@ func (oiba orderIDsByAccount) unsafeGetOrderIDsByAccount(db nosql.DB, accID stri
if err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error loading order %s for account %s", oid, accID))
}
if o, err = o.updateStatus(db); err != nil {
if o, err = o.UpdateStatus(db); err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error updating order %s for account %s", oid, accID))
}
if o.Status == StatusPending {
@ -198,7 +200,7 @@ func (oiba orderIDsByAccount) unsafeGetOrderIDsByAccount(db nosql.DB, accID stri
// If the number of pending orders is less than the number of orders in the
// list, then update the pending order list.
if len(pendOids) != len(oids) {
if err = orderIDs(pendOids).save(db, oids, accID); err != nil {
if err = orderIDs(pendOiUs).save(db, oids, accID); err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error storing orderIDs as part of getOrderIDsByAccount logic: "+
"len(orderIDs) = %d", len(pendOids)))
}
@ -248,225 +250,3 @@ func (oids orderIDs) save(db nosql.DB, old orderIDs, accID string) error {
return nil
}
}
func (o *order) save(db nosql.DB, old *order) error {
var (
err error
oldB []byte
)
if old == nil {
oldB = nil
} else {
if oldB, err = json.Marshal(old); err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling old acme order"))
}
}
newB, err := json.Marshal(o)
if err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling new acme order"))
}
_, swapped, err := db.CmpAndSwap(orderTable, []byte(o.ID), oldB, newB)
switch {
case err != nil:
return ServerInternalErr(errors.Wrap(err, "error storing order"))
case !swapped:
return ServerInternalErr(errors.New("error storing order; " +
"value has changed since last read"))
default:
return nil
}
}
// updateStatus updates order status if necessary.
func (o *order) updateStatus(db nosql.DB) (*order, error) {
_newOrder := *o
newOrder := &_newOrder
now := time.Now().UTC()
switch o.Status {
case StatusInvalid:
return o, nil
case StatusValid:
return o, nil
case StatusReady:
// check expiry
if now.After(o.Expires) {
newOrder.Status = StatusInvalid
newOrder.Error = MalformedErr(errors.New("order has expired"))
break
}
return o, nil
case StatusPending:
// check expiry
if now.After(o.Expires) {
newOrder.Status = StatusInvalid
newOrder.Error = MalformedErr(errors.New("order has expired"))
break
}
var count = map[string]int{
StatusValid: 0,
StatusInvalid: 0,
StatusPending: 0,
}
for _, azID := range o.Authorizations {
az, err := getAuthz(db, azID)
if err != nil {
return nil, err
}
if az, err = az.updateStatus(db); err != nil {
return nil, err
}
st := az.getStatus()
count[st]++
}
switch {
case count[StatusInvalid] > 0:
newOrder.Status = StatusInvalid
// No change in the order status, so just return the order as is -
// without writing any changes.
case count[StatusPending] > 0:
return newOrder, nil
case count[StatusValid] == len(o.Authorizations):
newOrder.Status = StatusReady
default:
return nil, ServerInternalErr(errors.New("unexpected authz status"))
}
default:
return nil, ServerInternalErr(errors.Errorf("unrecognized order status: %s", o.Status))
}
if err := newOrder.save(db, o); err != nil {
return nil, err
}
return newOrder, nil
}
// finalize signs a certificate if the necessary conditions for Order completion
// have been met.
func (o *order) finalize(db nosql.DB, csr *x509.CertificateRequest, auth SignAuthority, p Provisioner) (*order, error) {
var err error
if o, err = o.updateStatus(db); err != nil {
return nil, err
}
switch o.Status {
case StatusInvalid:
return nil, OrderNotReadyErr(errors.Errorf("order %s has been abandoned", o.ID))
case StatusValid:
return o, nil
case StatusPending:
return nil, OrderNotReadyErr(errors.Errorf("order %s is not ready", o.ID))
case StatusReady:
break
default:
return nil, ServerInternalErr(errors.Errorf("unexpected status %s for order %s", o.Status, o.ID))
}
// RFC8555: The CSR MUST indicate the exact same set of requested
// identifiers as the initial newOrder request. Identifiers of type "dns"
// MUST appear either in the commonName portion of the requested subject
// name or in an extensionRequest attribute [RFC2985] requesting a
// subjectAltName extension, or both.
if csr.Subject.CommonName != "" {
csr.DNSNames = append(csr.DNSNames, csr.Subject.CommonName)
}
csr.DNSNames = uniqueLowerNames(csr.DNSNames)
orderNames := make([]string, len(o.Identifiers))
for i, n := range o.Identifiers {
orderNames[i] = n.Value
}
orderNames = uniqueLowerNames(orderNames)
// Validate identifier names against CSR alternative names.
//
// Note that with certificate templates we are not going to check for the
// absence of other SANs as they will only be set if the templates allows
// them.
if len(csr.DNSNames) != len(orderNames) {
return nil, BadCSRErr(errors.Errorf("CSR names do not match identifiers exactly: CSR names = %v, Order names = %v", csr.DNSNames, orderNames))
}
sans := make([]x509util.SubjectAlternativeName, len(csr.DNSNames))
for i := range csr.DNSNames {
if csr.DNSNames[i] != orderNames[i] {
return nil, BadCSRErr(errors.Errorf("CSR names do not match identifiers exactly: CSR names = %v, Order names = %v", csr.DNSNames, orderNames))
}
sans[i] = x509util.SubjectAlternativeName{
Type: x509util.DNSType,
Value: csr.DNSNames[i],
}
}
// Get authorizations from the ACME provisioner.
ctx := provisioner.NewContextWithMethod(context.Background(), provisioner.SignMethod)
signOps, err := p.AuthorizeSign(ctx, "")
if err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error retrieving authorization options from ACME provisioner"))
}
// Template data
data := x509util.NewTemplateData()
data.SetCommonName(csr.Subject.CommonName)
data.Set(x509util.SANsKey, sans)
templateOptions, err := provisioner.TemplateOptions(p.GetOptions(), data)
if err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error creating template options from ACME provisioner"))
}
signOps = append(signOps, templateOptions)
// Create and store a new certificate.
certChain, err := auth.Sign(csr, provisioner.SignOptions{
NotBefore: provisioner.NewTimeDuration(o.NotBefore),
NotAfter: provisioner.NewTimeDuration(o.NotAfter),
}, signOps...)
if err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error generating certificate for order %s", o.ID))
}
cert, err := newCert(db, CertOptions{
AccountID: o.AccountID,
OrderID: o.ID,
Leaf: certChain[0],
Intermediates: certChain[1:],
})
if err != nil {
return nil, err
}
_newOrder := *o
newOrder := &_newOrder
newOrder.Certificate = cert.ID
newOrder.Status = StatusValid
if err := newOrder.save(db, o); err != nil {
return nil, err
}
return newOrder, nil
}
// toACME converts the internal Order type into the public acmeOrder type for
// presentation in the ACME protocol.
func (o *order) toACME(ctx context.Context, db nosql.DB, dir *directory) (*Order, error) {
}
// uniqueLowerNames returns the set of all unique names in the input after all
// of them are lowercased. The returned names will be in their lowercased form
// and sorted alphabetically.
func uniqueLowerNames(names []string) (unique []string) {
nameMap := make(map[string]int, len(names))
for _, name := range names {
nameMap[strings.ToLower(name)] = 1
}
unique = make([]string, 0, len(nameMap))
for name := range nameMap {
unique = append(unique, name)
}
sort.Strings(unique)
return
}

3
acme/errors.go
View file

@ -186,6 +186,9 @@ func RejectedIdentifierErr(err error) *Error {
// ServerInternalErr returns a new acme error.
func ServerInternalErr(err error) *Error {
if err == nil {
return nil
}
return &Error{
Type: serverInternalErr,
Detail: "The server experienced an internal error",

0
acme/types/nonce.go → acme/nonce.go
View file

355
acme/order.go
View file

@ -1,4 +1,3 @@
package acme
import (
"context"
@ -6,20 +5,13 @@ import (
"encoding/json"
"sort"
"strings"
"sync"
"time"
"github.com/pkg/errors"
"github.com/smallstep/certificates/authority/provisioner"
"github.com/smallstep/nosql"
"go.step.sm/crypto/x509util"
)
var defaultOrderExpiry = time.Hour * 24
// Mutex for locking ordersByAccount index operations.
var ordersByAccountMux sync.Mutex
// Order contains order metadata for the ACME protocol order type.
type Order struct {
Status string `json:"status"`
@ -32,6 +24,9 @@ type Order struct {
Finalize string `json:"finalize"`
Certificate string `json:"certificate,omitempty"`
ID string `json:"-"`
ProvisionerID string `json:"-"`
DefaultDuration time.Duration `json:"-"`
Backdate time.Duration `json:"-"`
}
// ToLog enables response logging.
@ -43,251 +38,33 @@ func (o *Order) ToLog() (interface{}, error) {
return string(b), nil
}
// GetID returns the Order ID.
func (o *Order) GetID() string {
return o.ID
}
// OrderOptions options with which to create a new Order.
type OrderOptions struct {
AccountID string `json:"accID"`
Identifiers []Identifier `json:"identifiers"`
NotBefore time.Time `json:"notBefore"`
NotAfter time.Time `json:"notAfter"`
backdate time.Duration
defaultDuration time.Duration
}
type order struct {
ID string `json:"id"`
AccountID string `json:"accountID"`
Created time.Time `json:"created"`
Expires time.Time `json:"expires,omitempty"`
Status string `json:"status"`
Identifiers []Identifier `json:"identifiers"`
NotBefore time.Time `json:"notBefore,omitempty"`
NotAfter time.Time `json:"notAfter,omitempty"`
Error *Error `json:"error,omitempty"`
Authorizations []string `json:"authorizations"`
Certificate string `json:"certificate,omitempty"`
}
// newOrder returns a new Order type.
func newOrder(db nosql.DB, ops OrderOptions) (*order, error) {
id, err := randID()
if err != nil {
return nil, err
}
authzs := make([]string, len(ops.Identifiers))
for i, identifier := range ops.Identifiers {
az, err := newAuthz(db, ops.AccountID, identifier)
if err != nil {
return nil, err
}
authzs[i] = az.getID()
}
now := clock.Now()
var backdate time.Duration
nbf := ops.NotBefore
if nbf.IsZero() {
nbf = now
backdate = -1 * ops.backdate
}
naf := ops.NotAfter
if naf.IsZero() {
naf = nbf.Add(ops.defaultDuration)
}
o := &order{
ID: id,
AccountID: ops.AccountID,
Created: now,
Status: StatusPending,
Expires: now.Add(defaultOrderExpiry),
Identifiers: ops.Identifiers,
NotBefore: nbf.Add(backdate),
NotAfter: naf,
Authorizations: authzs,
}
if err := o.save(db, nil); err != nil {
return nil, err
}
var oidHelper = orderIDsByAccount{}
_, err = oidHelper.addOrderID(db, ops.AccountID, o.ID)
if err != nil {
return nil, err
}
return o, nil
}
type orderIDsByAccount struct{}
// addOrderID adds an order ID to a users index of in progress order IDs.
// This method will also cull any orders that are no longer in the `pending`
// state from the index before returning it.
func (oiba orderIDsByAccount) addOrderID(db nosql.DB, accID string, oid string) ([]string, error) {
ordersByAccountMux.Lock()
defer ordersByAccountMux.Unlock()
// Update the "order IDs by account ID" index
oids, err := oiba.unsafeGetOrderIDsByAccount(db, accID)
if err != nil {
return nil, err
}
newOids := append(oids, oid)
if err = orderIDs(newOids).save(db, oids, accID); err != nil {
// Delete the entire order if storing the index fails.
db.Del(orderTable, []byte(oid))
return nil, err
}
return newOids, nil
}
// unsafeGetOrderIDsByAccount retrieves a list of Order IDs that were created by the
// account.
func (oiba orderIDsByAccount) unsafeGetOrderIDsByAccount(db nosql.DB, accID string) ([]string, error) {
b, err := db.Get(ordersByAccountIDTable, []byte(accID))
if err != nil {
if nosql.IsErrNotFound(err) {
return []string{}, nil
}
return nil, ServerInternalErr(errors.Wrapf(err, "error loading orderIDs for account %s", accID))
}
var oids []string
if err := json.Unmarshal(b, &oids); err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error unmarshaling orderIDs for account %s", accID))
}
// Remove any order that is not in PENDING state and update the stored list
// before returning.
//
// According to RFC 8555:
// The server SHOULD include pending orders and SHOULD NOT include orders
// that are invalid in the array of URLs.
pendOids := []string{}
for _, oid := range oids {
o, err := getOrder(db, oid)
if err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error loading order %s for account %s", oid, accID))
}
if o, err = o.updateStatus(db); err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error updating order %s for account %s", oid, accID))
}
if o.Status == StatusPending {
pendOids = append(pendOids, oid)
}
}
// If the number of pending orders is less than the number of orders in the
// list, then update the pending order list.
if len(pendOids) != len(oids) {
if err = orderIDs(pendOids).save(db, oids, accID); err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error storing orderIDs as part of getOrderIDsByAccount logic: "+
"len(orderIDs) = %d", len(pendOids)))
}
}
return pendOids, nil
}
type orderIDs []string
// save is used to update the list of orderIDs keyed by ACME account ID
// stored in the database.
//
// This method always converts empty lists to 'nil' when storing to the DB. We
// do this to avoid any confusion between an empty list and a nil value in the
// db.
func (oids orderIDs) save(db nosql.DB, old orderIDs, accID string) error {
var (
err error
oldb []byte
newb []byte
)
if len(old) == 0 {
oldb = nil
} else {
oldb, err = json.Marshal(old)
if err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling old order IDs slice"))
}
}
if len(oids) == 0 {
newb = nil
} else {
newb, err = json.Marshal(oids)
if err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling new order IDs slice"))
}
}
_, swapped, err := db.CmpAndSwap(ordersByAccountIDTable, []byte(accID), oldb, newb)
switch {
case err != nil:
return ServerInternalErr(errors.Wrapf(err, "error storing order IDs for account %s", accID))
case !swapped:
return ServerInternalErr(errors.Errorf("error storing order IDs "+
"for account %s; order IDs changed since last read", accID))
default:
return nil
}
}
func (o *order) save(db nosql.DB, old *order) error {
var (
err error
oldB []byte
)
if old == nil {
oldB = nil
} else {
if oldB, err = json.Marshal(old); err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling old acme order"))
}
}
newB, err := json.Marshal(o)
if err != nil {
return ServerInternalErr(errors.Wrap(err, "error marshaling new acme order"))
}
_, swapped, err := db.CmpAndSwap(orderTable, []byte(o.ID), oldB, newB)
switch {
case err != nil:
return ServerInternalErr(errors.Wrap(err, "error storing order"))
case !swapped:
return ServerInternalErr(errors.New("error storing order; " +
"value has changed since last read"))
default:
return nil
}
}
// updateStatus updates order status if necessary.
func (o *order) updateStatus(db nosql.DB) (*order, error) {
_newOrder := *o
newOrder := &_newOrder
// UpdateStatus updates the ACME Order Status if necessary.
// Changes to the order are saved using the database interface.
func (o *Order) UpdateStatus(ctx context.Context, db DB) error {
now := time.Now().UTC()
expiry, err := time.Parse(time.RFC3339, o.Expires)
if err != nil {
return ServerInternalErr(errors.Wrap("error converting expiry string to time"))
}
switch o.Status {
case StatusInvalid:
return o, nil
return nil
case StatusValid:
return o, nil
return nil
case StatusReady:
// check expiry
if now.After(o.Expires) {
newOrder.Status = StatusInvalid
newOrder.Error = MalformedErr(errors.New("order has expired"))
// Check expiry
if now.After(expiry) {
o.Status = StatusInvalid
o.Error = MalformedErr(errors.New("order has expired"))
break
}
return o, nil
return nil
case StatusPending:
// check expiry
if now.After(o.Expires) {
newOrder.Status = StatusInvalid
newOrder.Error = MalformedErr(errors.New("order has expired"))
// Check expiry
if now.After(expiry) {
o.Status = StatusInvalid
o.Error = MalformedErr(errors.New("order has expired"))
break
}
@ -297,27 +74,27 @@ func (o *order) updateStatus(db nosql.DB) (*order, error) {
StatusPending: 0,
}
for _, azID := range o.Authorizations {
az, err := getAuthz(db, azID)
az, err := db.GetAuthorization(ctx, azID)
if err != nil {
return nil, err
return false, err
}
if az, err = az.updateStatus(db); err != nil {
return nil, err
if az, err = az.UpdateStatus(db); err != nil {
return false, err
}
st := az.getStatus()
st := az.Status
count[st]++
}
switch {
case count[StatusInvalid] > 0:
newOrder.Status = StatusInvalid
o.Status = StatusInvalid
// No change in the order status, so just return the order as is -
// without writing any changes.
case count[StatusPending] > 0:
return newOrder, nil
return nil
case count[StatusValid] == len(o.Authorizations):
newOrder.Status = StatusReady
o.Status = StatusReady
default:
return nil, ServerInternalErr(errors.New("unexpected authz status"))
@ -325,28 +102,24 @@ func (o *order) updateStatus(db nosql.DB) (*order, error) {
default:
return nil, ServerInternalErr(errors.Errorf("unrecognized order status: %s", o.Status))
}
if err := newOrder.save(db, o); err != nil {
return nil, err
}
return newOrder, nil
return db.UpdateOrder(ctx, o)
}
// finalize signs a certificate if the necessary conditions for Order completion
// have been met.
func (o *order) finalize(db nosql.DB, csr *x509.CertificateRequest, auth SignAuthority, p Provisioner) (*order, error) {
func (o *order) Finalize(ctx, db DB, csr *x509.CertificateRequest, auth SignAuthority, p Provisioner) error {
var err error
if o, err = o.updateStatus(db); err != nil {
if o, err = o.UpdateStatus(db); err != nil {
return nil, err
}
switch o.Status {
case StatusInvalid:
return nil, OrderNotReadyErr(errors.Errorf("order %s has been abandoned", o.ID))
return OrderNotReadyErr(errors.Errorf("order %s has been abandoned", o.ID))
case StatusValid:
return o, nil
return nil
case StatusPending:
return nil, OrderNotReadyErr(errors.Errorf("order %s is not ready", o.ID))
return OrderNotReadyErr(errors.Errorf("order %s is not ready", o.ID))
case StatusReady:
break
default:
@ -366,7 +139,7 @@ func (o *order) finalize(db nosql.DB, csr *x509.CertificateRequest, auth SignAut
for i, n := range o.Identifiers {
orderNames[i] = n.Value
}
orderNames = uniqueLowerNames(orderNames)
orderNames = uniqueSortedLowerNames(orderNames)
// Validate identifier names against CSR alternative names.
//
@ -425,59 +198,15 @@ func (o *order) finalize(db nosql.DB, csr *x509.CertificateRequest, auth SignAut
return nil, err
}
_newOrder := *o
newOrder := &_newOrder
newOrder.Certificate = cert.ID
newOrder.Status = StatusValid
if err := newOrder.save(db, o); err != nil {
return nil, err
}
return newOrder, nil
o.Certificate = cert.ID
o.Status = StatusValid
return db.UpdateOrder(ctx, o)
}
// getOrder retrieves and unmarshals an ACME Order type from the database.
func getOrder(db nosql.DB, id string) (*order, error) {
b, err := db.Get(orderTable, []byte(id))
if nosql.IsErrNotFound(err) {
return nil, MalformedErr(errors.Wrapf(err, "order %s not found", id))
} else if err != nil {
return nil, ServerInternalErr(errors.Wrapf(err, "error loading order %s", id))
}
var o order
if err := json.Unmarshal(b, &o); err != nil {
return nil, ServerInternalErr(errors.Wrap(err, "error unmarshaling order"))
}
return &o, nil
}
// toACME converts the internal Order type into the public acmeOrder type for
// presentation in the ACME protocol.
func (o *order) toACME(ctx context.Context, db nosql.DB, dir *directory) (*Order, error) {
azs := make([]string, len(o.Authorizations))
for i, aid := range o.Authorizations {
azs[i] = dir.getLink(ctx, AuthzLink, true, aid)
}
ao := &Order{
Status: o.Status,
Expires: o.Expires.Format(time.RFC3339),
Identifiers: o.Identifiers,
NotBefore: o.NotBefore.Format(time.RFC3339),
NotAfter: o.NotAfter.Format(time.RFC3339),
Authorizations: azs,
Finalize: dir.getLink(ctx, FinalizeLink, true, o.ID),
ID: o.ID,
}
if o.Certificate != "" {
ao.Certificate = dir.getLink(ctx, CertificateLink, true, o.Certificate)
}
return ao, nil
}
// uniqueLowerNames returns the set of all unique names in the input after all
// uniqueSortedLowerNames returns the set of all unique names in the input after all
// of them are lowercased. The returned names will be in their lowercased form
// and sorted alphabetically.
func uniqueLowerNames(names []string) (unique []string) {
func uniqueSortedLowerNames(names []string) (unique []string) {
nameMap := make(map[string]int, len(names))
for _, name := range names {
nameMap[strings.ToLower(name)] = 1

0
acme/types/status.go → acme/status.go
View file

27
acme/types/authz.go
View file

@ -1,27 +0,0 @@
package types
import (
"encoding/json"
"github.com/pkg/errors"
)
// Authorization representst an ACME Authorization.
type Authorization struct {
Identifier Identifier `json:"identifier"`
Status string `json:"status"`
Expires string `json:"expires"`
Challenges []*Challenge `json:"challenges"`
Wildcard bool `json:"wildcard"`
ID string `json:"-"`
AccountID string `json:"-"`
}
// ToLog enables response logging.
func (a *Authz) ToLog() (interface{}, error) {
b, err := json.Marshal(a)
if err != nil {
return nil, ServerInternalErr(errors.Wrap(err, "error marshaling authz for logging"))
}
return string(b), nil
}

30
acme/types/challenge.go
View file

@ -1,30 +0,0 @@
package types
import (
"encoding/json"
"github.com/pkg/errors"
)
// Challenge represents an ACME response Challenge type.
type Challenge struct {
Type string `json:"type"`
Status string `json:"status"`
Token string `json:"token"`
Validated string `json:"validated,omitempty"`
URL string `json:"url"`
Error *AError `json:"error,omitempty"`
ID string `json:"-"`
AuthzID string `json:"-"`
AccountID string `json:"-"`
Value string `json:"-"`
}
// ToLog enables response logging.
func (c *Challenge) ToLog() (interface{}, error) {
b, err := json.Marshal(c)
if err != nil {
return nil, ServerInternalErr(errors.Wrap(err, "error marshaling challenge for logging"))
}
return string(b), nil
}

31
acme/types/order.go
View file

@ -1,31 +0,0 @@
package types
import (
"encoding/json"
"github.com/pkg/errors"
)
// Order contains order metadata for the ACME protocol order type.
type Order struct {
Status string `json:"status"`
Expires string `json:"expires,omitempty"`
Identifiers []Identifier `json:"identifiers"`
NotBefore string `json:"notBefore,omitempty"`
NotAfter string `json:"notAfter,omitempty"`
Error interface{} `json:"error,omitempty"`
Authorizations []string `json:"authorizations"`
Finalize string `json:"finalize"`
Certificate string `json:"certificate,omitempty"`
ID string `json:"-"`
ProvisionerID string `json:"-"`
}
// ToLog enables response logging.
func (o *Order) ToLog() (interface{}, error) {
b, err := json.Marshal(o)
if err != nil {
return nil, ServerInternalErr(errors.Wrap(err, "error marshaling order for logging"))
}
return string(b), nil
}